Subject: [PWE3] Comment on Re: Starting WG adoption call for draft-boutros-pwe3-mpls-tp-mac-wd-02

From: Sriganesh Kini <[email-masked]>
Date: Mon, 6 Feb 2012 15:55:23 -0800

Hi Sami and other authors,

A few comments
1. Does the sequence numbers have any rollover procedures or other
requirements ?
2. You mention that there are no security considerations. What if this
packet is spoofed by say a man-in-the-middle attack ?

On Mon, Jan 23, 2012 at 12:19 PM, Andrew G. Malis <[email-masked]> wrote:

> This begins a two-week PWE3 WG adoption call for
> https://tools.ietf.org/html/draft-boutros-pwe3-mpls-tp-mac-wd-02 , ending
> February 6. Please respond with your approval, disapproval, and other
> comments to the PWE3 list. If you don't support the adoption, providing a
> reason would be useful to the authors and the working group, but is not
> required. Of course, the reason why you support the draft is also welcome,
> but also optional. This request will be a part of PWE3 WG adoption calls
> going forward.
>
> Thanks,
> Andy and Matthew
>
>
> _______________________________________________
> pwe3 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pwe3
>
>

-- 
- Sri

---

From: Sami Boutros <[email-masked]>
Date: Mon, 06 Feb 2012 18:55:41 -0800

Hi Sri,

>1. Does the sequence numbers have any rollover procedures or other 

Sami: This is one of the comments that we need to address for sure as 
we progress the draft..

>2. You mention that there are no security considerations. What if 
>this packet is spoofed by say a man-in-the-middle attack ?

Sami: The reason here is that we will be using static PW-OAM and our 
security will be no better or no worse that what this mechanism provide.

Thanks,

Sami

>On Mon, Jan 23, 2012 at 12:19 PM, Andrew G. Malis 
><<mailto:[email-masked]>[email-masked]> wrote:
><https://tools.ietf.org/html/draft-boutros-pwe3-mpls-tp-mac-wd-02>https://tools.ietf.org/html/draft-boutros-pwe3-mpls-tp-mac-wd-02 
>, ending February 6. Please respond with your approval, disapproval, 
>and other comments to the PWE3 list. If you don't support the 
>adoption, providing a reason would be useful to the authors and the 
>working group, but is not required. Of course, the reason why you 
>support the draft is also welcome, but also optional. This request 
>will be a part of PWE3 WG adoption calls going forward.
>
>Thanks,
>Andy and Matthew
>
>
><mailto:[email-masked]>[email-masked]

---

From: Sriganesh Kini <[email-masked]>
Date: Tue, 7 Feb 2012 11:40:00 -0800

Sami,

See inline.

On Mon, Feb 6, 2012 at 6:55 PM, Sami Boutros <[email-masked]> wrote:

> Sami: This is one of the comments that we need to address for sure as we
> progress the draft..
>

This is a basic issue and it needs to be addressed before considering this
to be a WG draft.

> security will be no better or no worse that what this mechanism provide.

MAC flush can be forwarded beyond the receiving PE. So the problem gets
progressively worse. IMO we need to add security to PW-OAM (the alternative
being to use a mechanism other than PW-OAM).

-- 
- Sri

---

From: Neil McGill <[email-masked]>
Date: Tue, 7 Feb 2012 12:02:18 -0800 (PST)

> being to use a mechanism other than PW-OAM).

There is no security for the PW status bits either that are carried in this 
message, so one could just as easily inject a fault that would also induce the
equivalent of a mac flush. Or send standby and force a redundant VPLS switchover 
to another instance. These problems already exist with PW OAM; adding MAC flush 
is not making matters any worse as you could probably emulate a brute force flush 
by sending ac rx/tx faults...

The original intent was to keep the protocol simple, but if security is
a concern then it is a base concern with the protocol and we have to
look into adding some kind of digest or some other protocol all
together.

Thanks,

Neil.

---

From: Sriganesh Kini <[email-masked]>
Date: Wed, 8 Feb 2012 12:29:31 -0800

The status bits effects are limited to PW (or a few PWs like
primary/standby). So while the problem exists and needs to be solved, it
gets worse with MAC withdrawal since an empty MAC list can flush many MACs
in the whole network. A PE even though it handles optimized MAC withdrawal
could still treat a empty MAC list as per RFC4762 and open up a DoS attack
vector on the whole VPLS network. Since there is no authenticated signaling
channel as is used in signaled VPLS, this opens up a large security hole
that needs to be addressed. IMO the simplicity argument is not overriding
in this case.

On Tue, Feb 7, 2012 at 12:02 PM, Neil McGill <[email-masked]> wrote:

> we

-- 
- Sri

---

From: Sami Boutros <[email-masked]>
Date: Wed, 08 Feb 2012 14:13:46 -0800

Hi Sri,

>>A few comments
>>1. Does the sequence numbers have any rollover 
>>procedures or other requirements ?
>
>Sami: This is one of the comments that we need 
>to address for sure as we progress the draft..
>
>
>This is a basic issue and it needs to be 
>addressed before considering this to be a WG draft.
>Â

Sami: Neil suggested to use the half seq-id 
space, and use mod arith to work out if old. As 
well we will handled sequence 0 differently to 
force a Flush and reset the sequence #, will add 
this to the draft before becoming WG.

>>2. You mention that there are no security 
>>considerations. What if this packet is spoofed 
>>by say a man-in-the-middle attack ?
>
>Sami: The reason here is that we will be using 
>static PW-OAM and our security will be no better 
>or no worse that what this mechanism provide.
>
>
>MAC flush can be forwarded beyond the receiving 
>PE. So the problem gets progressively worse. IMO 
>we need to add security to PW-OAM (the 
>alternative being to use a mechanism other than PW-OAM).
>Â

Sami: Are you talking about the MS-PW case? why 
is that different than regular static PW-OAM Status?

Thanks,

Sami

---

From: Sriganesh Kini <[email-masked]>
Date: Thu, 9 Feb 2012 00:01:46 -0800

Hi Sami,

On Wed, Feb 8, 2012 at 2:13 PM, Sami Boutros <[email-masked]> wrote:

> Sami: Neil suggested to use the half seq-id space, and use mod arith to
> work out if old. As well we will handled sequence 0 differently to force a
> Flush and reset the sequence #, will add this to the draft before becoming
> WG.
>
>
> Sami: Are you talking about the MS-PW case? why is that different than
> regular static PW-OAM Status?
>

I am referring to the VPLS case (H-VPLS). See earlier email response to
Neil.

-- 
- Sri